CVE-2026-91107 openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2026-91107 openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2023-32243

CVE-2023-32243. Essential Addons for Elementor 5.4.0-5.7.1 - Unauthenticated Privilege Escalation Info The plugin does not validate the password reset key, which could allow unauthenticated attackers to reset arbitrary account's password to anything they want, by knowing the related email or...

BIT-MOODLE-2026-102586 Moodle: xss via password reset link due to insufficient username escaping

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

PT-2026-106280

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description In the packages/server/src/models/TokenModel.ts file, CSRF, account-confirmation, email-change, and password-reset tokens are stored without a designated purpose. Additionally, the...

CVE-2026-91107: Authorization Bypass Through User-Controlled Key

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

PT-2026-106256

Name of the Vulnerable Software and Affected Versions openSIS Classic version 9.3 Description An authenticated user with the teacher role can reset the password of any staff account. This is achieved by selecting an arbitrary staff record via the staff id variable within the School Information...

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

CVE-2026-104468

YesWiki versions prior to 4.6.7 are vulnerable to an insufficient session expiration vulnerability (CWE-613). The root cause is that password reset tokens lack expiry timestamps , allowing an attacker to reuse old reset links. If an attacker obtains an unused reset URL from sources such as mailbo...

CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

CVE-2026-94541

The WPMobile.App – Android and iOS App Builder plugin for WordPress (slug wpappninja) is vulnerable to an authorization bypass in all versions up to and including 11.82 . The flaw stems from a failure to verify user permissions when handling the wpapp_category[] parameter. If the plugin's mail-to...

EUVD-2026-91334

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacke...

PT-2026-104278

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

CVE-2026-104468: Insufficient Session Expiration

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

JetBrains TeamCity < 2025.11.8 / 2026.1.x < 2026.1.4 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.8, or 2026.1.x prior to 2026.1.4. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the...

PT-2026-104180

Name of the Vulnerable Software and Affected Versions WPMobile.App – Android and iOS App Builder versions prior to 11.83 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attacker...

CVE-2026-94541: Missing Authorization

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacke...